Responding To Ransomware - NYMISSA · Ransomware is getting more sophisticated, and shifting to an enterprise threat. Ransomware Nightmares ... 50% of ransomware victims have paid

X by Invincea

Responding To Ransomware

Ransomware NightmaresX by Invincea

Ransomware is getting more sophisticated, and shifting to an enterprise threat

Ransomware NightmaresX by Invincea

To Pay Or Not To Pay?X by Invincea

Your money or your files?

Argument for payingX by Invincea

“The ransomware is that good... To be honest, we often advise people just to pay

the ransom.”

-Joseph BonavolontaFBI Assistant Special Agent in Charge of the Cyber and

Counterintelligence Program Quote from 2015

Money or Files?X by Invincea

50% of ransomware victims have paid

40% said they would pay if they were hit with ransomware

Source: BitDefender

A RANSOMWARE

ANECDOTE

Argument against payingX by Invincea

•We don’t negotiate with terrorists

•Paying incents attackers to keep using ransomware

Argument against payingX by Invincea

"The FBI doesn’t support paying a ransom in response to a ransomware attack.”

-James TrainorFBI Cyber Division Assistant Director

Quote from April 2016

Criminals Are UnreliableX by Invincea

"Paying a ransom doesn’t guarantee an organization that it will get its data back—we’ve

seen cases where organizations never got a decryption key after having paid the ransom.”

-James TrainorFBI Cyber Division Assistant Director

Quote from April 2016

Average price of ransomware

Some ransom demands are as high as $50K

True cost of a large ransomware attack

Amount extorted by CryptoWall since 2015

True CostX by Invincea

Ransomware Trends

TargetsX by Invincea

Critical Infrastructure:

• Healthcare

• Government

• Law Enforcement

• Energy

• Financial

1

3

2

Weaponized Office documents

Malicious email links

Unauthorized programs

Malvertising

Top Infection MethodsX by Invincea

TrendsX by Invincea

Ransomware and Weaponized Docs (which can spread ransomware) increased in May

Constant State of InnovationX by Invincea

•2-for-the-price-of-1 Ransomware: Ransomware + DDOS

•Hash Factory: Ransomware changes hash every 15 seconds

•Server-side Ransomware: Beyond the desktop

•Viral Ransomware: Spreads like a virus

Recommendations

• TeslaCrypt (v3.0-v4.2)

–ESET was able to get the decryption key by ASKING attackers for it. Seriously.

• Decryption tools are available for:

–777

–Xorist

–8Lock8

–GhostCrypt

Limited Decryption AbilityX by Invincea

Common Advice Only Helps So MuchX by Invincea

•Keep Your AV up-to-date

•Filter your email

•Patch everything all the time

•Careful what you click

"Users will open attachments, they will visit sites that are infected, and when that happens, you just need to make sure that your security technology protects you.”

-Anup GhoshCEO, Invincea

Wired Magazine, May 2016

Our RecommendationsX by Invincea

•Deploy anti-malware prevention

•Behavioral monitoring

•Isolation

•Back it up!!!!

"network shares are as at risk as your desktop system in a ransomware infection. If the

backups are done offline, and the backup is not reachable from the machine that is infected,

then you’re fine.”

-Anup GhoshCEO, Invincea

Wired Magazine, May 2016

Business Continuity & Disaster RecoveryX by Invincea

• Develop a business continuity plan for what happens if you loose access to your data or systems

• Backup your data and airgap it from your primary network

–Put controls in place that will allow you to rapidly your recover files

• Have an IR plan in place with access to 3rd parties that can assist

Final RecommendationX by Invincea

“Don’t pay unless you absolutely have to!”

-Yours trulyQuote from … today

THANK YOU

www.invincea.com